Privacy policy
This English text is for convenience. The Dutch version is legally authoritative. Privacyverklaring
Summary
- Messages you send are used to answer, to book time and to run the session you reserved.
- We run no mailing list, buy no ads with your details and never trade personal data.
- A take of your voice is not fed into machine-learning systems and stays off our public pages unless you agree in writing.
- Rights requests go to [email protected] or the contact form; you may also complain to the Dutch DPA.
1. Who processes this data
Controller: Gregorxyra B.V. (we), a private limited company (B.V.) whose issued capital is €100, office at Bilderdijkstraat 78, 1053 KM Amsterdam, the Netherlands. Personal data reach us through gregorxyra.click and through the work around a booking: a quote, a reservation, time in the rooms and the invoice afterwards. Chamber of Commerce 60126156. VAT identification NL822390267B01. Saskia de Vries is studio director, recording engineer and the person accountable for what we publish.
Four reasons sit behind the processing: so we can match a room and a rate to the job you describe; so a mail or a call gets an answer; so later sessions can follow what you already told us; and so quotes, invoices and the accounts stay in order. The General Data Protection Regulation and the Dutch Implementation Act set the frame. We treat the files with care and we resist unauthorised reading, sharing, rewriting or wiping.
No data-protection officer is on the roster. For a studio of this size that function is not required. Write to [email protected] or call 020 261 4873 if a privacy point is unclear. Hours on site: Monday to Friday 10:00–22:00, Saturday 11:00–18:00, by appointment; closed Sunday.
Dutch is the language that counts. This English page exists so readers who work in English can follow the same facts.
2. When this policy applies
Readers of gregorxyra.click, people who phone, write or submit the form, and anyone who books Voice and voice-over recording, Mixing, Mastering, Podcast recording or Live and band recording fall under this text. It states what we do and which rights you keep.
A different hat goes on when a company hires us to capture other people's voices — a narrator sent by a production house, guests in a branded series. That company chooses why those takes exist. In that case we are a processor and the data processing agreement applies to those people. Their information notice comes from that company. Planning and billing data that we collect for our own administration still follow the paragraphs below.
3. The data we collect
Contact form: your name, mailbox, an optional phone number, the service you have in mind, an optional preferred day and a short note about the project. Fields marked as required exist so we can answer; a quote is not prepared if those fields stay empty. FormSubmit, operated from the United States, forwards the submission. Cross-border detail sits in transfers outside the EEA.
After you book: billing lines, a band or artist name, whatever the quote needed, the mail or call trail, and the reference on a bank transfer. 30 percent is taken as a deposit and stays in the booking file. Payment-card numbers are not kept here.
In the rooms: a voice or a performance is personal data once a listener can tell who it is. We handle those files to deliver the service on the confirmation. Camera work by your own crew stays with you.
On the wire: TransIP B.V. stores connection logs (address on the network, clock time, requested page, browser) so the site can be defended. The browser keeps your tracker decision under grgr_consent_v1 in local storage; that slot holds neither a name nor a mailbox.
Health, religion and political views are not requested. If illness forces a move, a short message that you cannot come is enough; a doctor's note is not. There is no newsletter. Software here does not take decisions about you on its own and does not build a marketing profile.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answer a question and draft a quote | Form, email, phone | Steps before a contract, started by you (Art. 6(1)(b)) | Three years counted from the last exchange |
| Reserve, deliver and close the job | Identity, contact details, project, diary | Performing the contract (Art. 6(1)(b)) | Five years after the relationship stops (limitation, Dutch Civil Code) |
| Hold working session files | Takes, project folders | Performing the contract (Art. 6(1)(b)) | 24 months after the latest session, then wipe |
| Raise invoices and keep accounts | Identity, invoice, payments | Duty in law (Art. 6(1)(c)) | Seven years (tax archive, Art. 52 of the General Tax Act) |
| Handle a complaint or a dispute | Letters, the case file | A real interest in defending our position (Art. 6(1)(f)) | As long as the case and any appeal last |
| Defend the website | Host connection logs | A real interest (Art. 6(1)(f)) | No more than twelve months |
| Remember how you set trackers | Key grgr_consent_v1 in the browser | Duty in law (Art. 11.7a Dutch Telecommunications Act) | 182 days |
Personal data are not sold and not rented out. Marketing mail is not sent. A fresh purpose appears only when it still fits the old one, or after a new consent.
Where a legitimate interest is the basis, we test three things: the aim is genuine, the method is needed, and your interests do not outweigh it. A short note of that test is available on request, and you may object. Business invoices wait 14 days; those records follow the tax archive above. Figures on the site, such as Voice and voice-over recording from €88 an hour with 21 percent VAT included, live on services and in the terms and conditions.
5. Voice, image, minors and AI
Private life covers both voice and face. A clip from your session, a picture of you in the rooms or your name on our pages or social channels stays unpublished unless you first agree in writing. Pictures on gregorxyra.click are generated atmosphere stills, not photographs of people who booked.
Client takes are not used to teach, try out or tune artificial-intelligence systems. A synthetic copy of a voice is not built unless the person concerned has given a specific written go-ahead.
Anyone younger than 16 is booked by a parent or guardian, who supplies the needed details. Article 5 of the Dutch Implementation Act puts that same age on solo consent for an information-society service. The form is written for adults or representatives; nothing here is aimed at children. Podcast guests and music licences are sketched in the guide to podcast rights; that article does not stand in for this policy.
6. Who can access your data
Inside the building, only the people who need the file for their task see it: Saskia de Vries, Lars Meijer (mixing and mastering) and Noor Bakker (podcast production and the diary). Outside that circle, only the parties below, and only for the purposes already named:
- TransIP B.V. (Vondellaan 47, 2332 AA Leiden, Netherlands), which hosts the site, the mailbox and storage, in Union data centres; their pages: TransIP B.V.;
- FormSubmit (formsubmit.co), which relays the form into our mailbox;
- the accountant, bound to silence, for billing lines;
- the bank, for transfers;
- a lawyer or a court, if a dispute is opened;
- authorities that ask inside the law.
Each party that processes for us does so under a set-up that meets Article 28 GDPR. No consumer mediation body is named in our file; the path for a dispute is in the terms and conditions and the legal notice.
7. Transfers outside the European Economic Area
Files we hold sit in the Union, with TransIP B.V. in Leiden. FormSubmit is run from the United States, so a form submission travels through that service. We have not seen that provider listed under the EU-US Data Privacy Framework. Article 49(1)(b) GDPR is the hook we rely on: the transfer is required to take the steps you start by sending a project.
A mailbox or a phone call avoids that hop: [email protected] or 020 261 4873. The request is handled in the same way. Stems, references or scripts after a booking can travel on a channel we agree, without the web form.
8. Security
Measures match the work: HTTPS only on the site, client folders limited to named accounts with strong passwords, a second factor where the tool offers it, encrypted disks on the desks, the door locked when no session is running, and session files wiped after 24 months. The entrance on Bilderdijkstraat 78 in Oud-West is at street level. 3 rooms are in use (live 30 m², booth 11 m², control 20 m²). Planned visits only, at most 8 guests.
A breach that puts rights at risk is notified to the Autoriteit Persoonsgegevens inside 72 hours (Article 33 GDPR). If the risk is high we also write to you (Article 34). A path across the public network is never perfectly safe; our measures start once the data have arrived.
9. Your rights
The Regulation gives you these levers:
- see your data and learn how they are processed (Art. 15 GDPR);
- correct what is wrong or incomplete (Art. 16);
- ask for erasure, including when the purpose has ended (Art. 17);
- ask us to pause processing in the cases the text lists (Art. 18);
- receive, in a structured everyday format, the data you handed over (Art. 20);
- object when a legitimate interest is the basis (Art. 21);
- pull back consent; earlier work stays lawful (Art. 7(3));
- complain to the supervisory authority (Art. 77).
Send the request to [email protected] or to the postal address. One month is the ordinary reply window; two extra months are possible for a heavy file, and we say so (Art. 12(3) GDPR). The exercise itself is free. Reasonable doubt about identity lets us ask for more proof. Everyday studio mail we try to answer inside 2 working days; that habit is faster than the legal window, not a separate right.
The Dutch supervisory authority is the Autoriteit Persoonsgegevens, Bezuidenhoutseweg 30, 2594 AV The Hague, autoriteitpersoonsgegevens.nl. A first note to us usually closes the point. Diary and cancellation questions also live in the FAQ.
10. Cookies and similar techniques
A cookie is a small file a site writes to a device so a preference can be recalled or use can be measured. Local storage, beacons and pixels do related jobs.
gregorxyra.click places nothing for statistics, advertising or social networks. The only stored item is your tracker decision in local storage (grgr_consent_v1) for 182 days. The banner splits five groups — necessary, functional, analytics, marketing, preferences — and shows three buttons of the same weight: accept everything, refuse everything, or pick by group. The four optional groups are empty today.
A later tracker that needs consent will be announced and asked for again. The inventory sits in the cookie policy. The banner can be opened once more with .
11. Links to other websites
Outbound links include OpenStreetMap for the pin on Bilderdijkstraat 78. Those destinations keep their own privacy rules; their practice is not ours. A route in ordinary language is on contact: The studio is on Bilderdijkstraat in Oud-West, about a ten-minute walk from Leidseplein. Trams 1 and 7 serve the Bilderdijkstraat stop, roughly three minutes on foot from there. The entrance is at street level, which makes bringing cases or instruments straightforward.
12. Status and changes
The page describes how we work. It does not cut back rights that statute already gives. Services or rules may force an update. The new text appears here with its start date and takes the place of the older one. A substantial shift is mailed to people who already booked. Start date: 1 October 2026. Last pass: 1 October 2026. Dutch wording governs; this English page is for readers who want the same facts in English.
Write or call: Gregorxyra B.V., Bilderdijkstraat 78, 1053 KM Amsterdam — [email protected] — 020 261 4873. Studio background: about us. Access to the pages and the building: accessibility statement.